AuthorizeUsersForApp-阿里云帮助中心

Adds or removes authorized users for a specified application deployed in a delivery group. Only authorized users can access the application.

Operation description

This operation manages user authorization for a delivery group at the application level. The authorization result applies only to the application specified by AppId and does not affect the authorization of other applications in the delivery group. To authorize users for an entire delivery group, call the AuthorizeInstanceGroup operation.

Before you begin

The delivery group is created, and the application specified by AppId is deployed in the image used by the delivery group. Otherwise, the error code InvalidAppId.NotFound is returned.
The delivery group has not been added to a delivery group set that is in effect. A delivery group that has been added to a set cannot be authorized individually. You must authorize it through the set. Otherwise, the error code InvalidAppInstanceGroup.AuthorizeBlockedBySet is returned.
If the workspace to which the delivery group belongs is an Active Directory (AD) workspace, you must specify UserMeta, with UserMeta.Type set to ad and UserMeta.AdDomain matching the AD domain bound to the workspace.
If the delivery group has been authorized through user groups and mixed authorization of users and user groups is not supported, you cannot authorize by user. Otherwise, the error code AuthAppInstanceGroup.MixNotSupported is returned.

Parameter description

At least one of AuthorizeUserIds and UnAuthorizeUserIds must be specified. You can also specify both. If both are empty, this invocation does not change any authorization.
When adding authorizations, the sum of the currently authorized users for the application and the users to be added cannot exceed the authorized user quota for the application. If the quota is exceeded, the error code ExceedAppAuthUserQuota is returned. Removing authorizations is not subject to quota limits.

Call sequence

Call the ListAppInstanceGroup or GetAppInstanceGroup operation to obtain the delivery group ID (AppInstanceGroupId) and the application IDs of deployed applications in the delivery group (AppId in the Apps list).
Call the DescribeUsers operation to obtain the usernames of the users to be authorized or unauthorized.
Call this operation to complete the authorization change.

Note

After the authorization is changed, the selected users receive a notification email. It typically takes about 2 minutes for the change to take effect on the client.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
AppInstanceGroupId	string	Yes	The delivery group ID. You can call the ListAppInstanceGroup operation to obtain the ID. The application specified by AppId must be deployed in the image used by this delivery group.	aig-9ciijz60n4xsv****
ProductType	string	Yes	The product type. Application-level authorization applies to WUYING Cloud Application delivery groups. Valid values: CloudApp: WUYING Cloud Application. Valid values: CloudApp : WUYING Cloud Application.	CloudApp
AuthorizeUserIds	array	No	The list of usernames to add authorization for the application. A maximum of 100 usernames can be specified in a single request. At least one of AuthorizeUserIds and UnAuthorizeUserIds must be specified. You can also specify both. Adding authorization is subject to the authorized user quota for the application.
	string	No	The username to be authorized. You can call the DescribeUsers operation to obtain the username.	alice
UnAuthorizeUserIds	array	No	The list of usernames to be unauthorized for the application. A maximum of 100 usernames can be specified in a single request. At least one of AuthorizeUserIds and UnAuthorizeUserIds must be specified. You can also specify both. Removing authorizations is not subject to quota limits.
	string	No	The username to be unauthorized. You can call the DescribeUsers operation to obtain the username.	tom
UserMeta	object	No	The account information of the authorized user, which specifies the account type corresponding to the username. If the workspace to which the delivery group belongs is an AD workspace, this parameter is required: set Type to ad and set AdDomain to the AD domain bound to the workspace. If this parameter is not specified, the WUYING convenience account (simple) is used by default.
AdDomain	string	No	The AD domain name. Specify this parameter when Type is set to ad. The value must match the AD domain bound to the workspace of the delivery group.	example.com
Type	string	No	The account type. Default value: simple. Valid values: ad: AD account. simple: WUYING convenience account. Valid values: ad : AD account. simple : WUYING convenience account.	simple
AppId	string	Yes	The application ID. The application must be deployed in the image used by the delivery group. You can obtain the ID from the Apps list returned by the GetAppInstanceGroup operation.	ca-i87mycyn419nu****

Response elements

Element	Type	Description	Example
	object	Schema of Response
RequestId	string	The request ID.	1CBAFFAB-B697-4049-A9B1-67E1FC5F****

Examples

Success response

JSON format

{
  "RequestId": "1CBAFFAB-B697-4049-A9B1-67E1FC5F****"
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.